381993 - Crash [@ nsDOMMouseEvent::GetClientX] with mousemove generating and removing stuff

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk builds.
The testcase makes use of enhanced privileges, so you need to download it to your computer to get the crash.

Talkback ID: TB32498504K
0x02c5be7b
nsDOMMouseEvent::GetClientX  [mozilla/content/events/src/nsdommouseevent.cpp, line 207]
nsXULTooltipListener::MouseMove  [mozilla/layout/xul/base/src/nsxultooltiplistener.cpp, line 213]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nseventlistenermanager.cpp, line 1203]
nsEventTargetChainItem::HandleEvent  [mozilla/content/events/src/nseventdispatcher.cpp, line 202]
nsEventTargetChainItem::HandleEventTargetChain  [mozilla/content/events/src/nseventdispatcher.cpp, line 283]
nsEventDispatcher::Dispatch  [mozilla/content/events/src/nseventdispatcher.cpp, line 477]
PresShell::HandleEventInternal  [mozilla/layout/base/nspresshell.cpp, line 5634]
PresShell::HandlePositionedEvent  [mozilla/layout/base/nspresshell.cpp, line 5523]
PresShell::HandleEvent  [mozilla/layout/base/nspresshell.cpp, line 5359]
nsViewManager::HandleEvent  [mozilla/view/src/nsviewmanager.cpp, line 1285]
nsViewManager::DispatchEvent  [mozilla/view/src/nsviewmanager.cpp, line 1238]
HandleEvent  [mozilla/view/src/nsview.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nswindow.cpp, line 1112]
NS_InvokeByIndex_P  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2245]

Comment 1

[Martijn Wargers (dead)]

The stuff in the iframe is just:
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"></window>

Comment 2

[Martijn Wargers (dead)]

Hmm, the testcase is not crashing.
However, the testcase that I have locally (which is the same) is crashing.
If it doesn't crash the first time, you don't need to try again before you close and reopen the browser again.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

No luck with that testcase either.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Still can't reproduce (debug/non-debug) :/ 

Comment 7

[Eli Friedman]

Attachment: Patch

Obvious bug with a decent debugger trace.  (I put in a bunch of context because the real issue is at the call to DispatchEvent.)

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 266173 [details] [diff] [review]
Patch

ah, ofc.

Comment 9

[Eli Friedman]

Checked in.

Comment 10

[Martijn Wargers (dead)]

Thanks, verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070529 Minefield/3.0a5pre